T09 · Insecure Skill Coding Practices
Warning
- Location
generate-image.py:11- Finding
Hard-Coded Application Signing Key
- Content
View full analysis
- Remediation
View remediation
Security audit
Autoglm Generate Image
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to perform the advertised AutoGLM image-generation task, but users should know prompts and a local bearer token are sent to the documented external API.
Install only if you are comfortable with your image prompts being sent to AutoGLM and with the skill obtaining a bearer token from the documented localhost service. The publisher should rotate/remove the embedded signing key and document data handling more clearly, but the reviewed artifact does not show malicious behavior.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill performs network operations, including contacting a local token service and a remote image-generation API, but does not declare any tool scope or permissions. This weakens reviewability and consent because consumers cannot easily see that the skill will transmit data off-box and access localhost resources.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation states that user-provided text is automatically sent to a remote API and that a token is automatically fetched from a local HTTP service, but provides no privacy warning, consent flow, or data-handling notice. This is dangerous because prompts may contain sensitive information and localhost token brokers often expose privileged credentials that should not be used silently.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script silently retrieves a bearer token from a local service and immediately uses it to authenticate an outbound request to a third-party API. In a skill context, this can cause unintended credential use and data transfer without informed user consent, which is risky even if the token source is localhost.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
User-supplied prompt text is transmitted to an external image-generation service without any warning that the content leaves the local environment. This creates privacy and compliance risk because users may include sensitive or proprietary information in prompts, especially when the skill presents itself as a simple local utility.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language instructions and usage description are presented in Chinese only, which can amount to forcing a specific language on users without offering an opt-in or alternative. The policy allows locale constraints when clearly documented and justified, but no such justification or language-choice mechanism is provided here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Comments and usage strings are presented only in Chinese, and the script does not offer an alternative language or indicate that it is intentionally region-specific. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without opt-in.
- Content
Static analysis
No suspicious patterns detected.